<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"Preformattato HTML Carattere";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.PreformattatoHTMLCarattere
{mso-style-name:"Preformattato HTML Carattere";
mso-style-priority:99;
mso-style-link:"Preformattato HTML";
font-family:"Consolas",serif;}
span.StileMessaggioDiPostaElettronica23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:991719186;
mso-list-type:hybrid;
mso-list-template-ids:1023152740 1577247008 68157443 68157445 68157441 68157443 68157445 68157441 68157443 68157445;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" style="text-align:left; direction:ltr;">
<div>I'm very much a novice at this as well. </div>
<div><br>
</div>
<div>I don't remember what you need in there if it is a built in attribute. You may want to look at the samples, and see if you can find something there. But you are very much correct that the F_EXTENSION is because I'm using extended attributes. It's easier
with built in ones, I just don't have an example handy. </div>
<div><br>
</div>
<div>You can use the query playground to build that part out. That greater is there because I couldn't find a not null condition that worked for me. There are two attributes as those are the two I care about most. The other two, DeptId and supervisor are actually
ones I recently added that needed to be blanked about. In theory any of them other than supervisor id could be the single one I use to query on. I ran into a problem early on when trying to come up with this where I set the attributes to effectively the empty
string, instead of null. I wanted null. And my first round of experiments only changed one of those two. So I queried off of both. Now that my data should be consistent, I should be able to drop to just one of them.
</div>
<div><br>
</div>
<div>Effectively it is looking for anyone that has either of those values set to anything other than null. Turns out that the empty string is greater than null. It doesn't catch empty strings, but I shouldn't have cases of that happening in my data. So it find
all user objects that have those values set. Right now I have 37k users in midPoint, and that query filters it down to only those that have one of those two attributes set. I'm at a university, so most of my users are students, and don't have titles. So this
is the first good filter I can do to reduce the number of users I search.</div>
<div><br>
</div>
<div>Then from there the script checks to see if the user has an active shadow on the DB resource that put the attributes there. If it has an active shadow on that resource, then they are an active employee, and thus should keep those attributes. So it fires
a return to not touch that user.</div>
<div><br>
</div>
<div>So given how the file is laid out, it is kind of backwards. The object query fires first to generate a list of users, which is then passed to the executeScript one at a time. So the script doesn't do the looping, it is what is being called in the loop
over each user.</div>
<div><br>
</div>
<div>I do something very similar to remove people from orgs when they aren't in the right resource anymore (and at a prescribed time). I'm hoping late in November I can write something more comprehensive up and contribute examples back. Right now I'm in the
middle of a giant migration, and don't have much time to do that.</div>
<div><br>
</div>
<div>On Wed, 2020-10-21 at 16:15 +0000, Andrea Picconi wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Richard,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">thank you for your help. A couple of question about your .xml:
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I think that in the first part you are providing to the application the attributes that needs, right?<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:EN-US">F_EXTENSION</span></b><span lang="EN-US" style="mso-fareast-language:EN-US"> refers to the fact that they are extended attributes, but if instead they were “normal” attributes (the
base attributes of Midpoint) what can I use?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">In the second part (I apologize but I’m not familiar with coding ecc.), how the object query works? Which steps perform? Why I see only two attributes inside the <greater> tag?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Thank you for your time and help!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Andrea<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> midPoint <midpoint-bounces@lists.evolveum.com> <b>
On Behalf Of </b>Richard Frovarp via midPoint<br>
<b>Sent:</b> Wednesday, October 21, 2020 4:47 PM<br>
<b>To:</b> midpoint@lists.evolveum.com<br>
<b>Cc:</b> Richard Frovarp <richard.frovarp@ndsu.edu><br>
<b>Subject:</b> Re: [midPoint] Problem deprovisioning<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I was able to find a reasonable work around for my user population. I have a bulk task that runs every day. One feature that would be nice is this functionality in the query options that I use all of the time in our legacy system in direct
SQL<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">where pk not in (select pk from other_table where user has some sort of attribute)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Since I can't figure out how to do that in this query syntax, have a slight work around. I have a bulk task that runs on schedule. It queries for everyone that has one of the attributes I want to blank out. It then iterates through each
of those users to see if they have a shadow in the resource that created those attributes. If they don't, it blanks the attributes out. Attached is one such task. For anyone wondering, I am supporting two different institutions in midPoint, hence the need
for custom schema extension for attributes in midPoint already, like title. Plus I'm higher education, so people can be in multiple departments, hence the "primary". This takes just over 3 minutes on just under 6k people. And we really haven't taken any time
to tune the performance of our environment other than making sure midPoint has plenty of memory assigned to it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There's also probably a way to collapse this down to be a bit more efficient, but this is efficient enough for us at this moment. Note my method for checking if the user has a shadow in the specified resource. I was doing bad things previously
where I iterated over all shadows the user had, and that wasn't good. So only hunt for the one you want.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On Wed, 2020-10-21 at 16:34 +0200, Pavol Mederly via midPoint wrote:<o:p></o:p></p>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<p>Hello,<o:p></o:p></p>
<p>as far as I know, this seemingly "innocent" scenario is surprisingly not directly supported by midPoint. Richard Frovarp asked about it here in July. Just look for "How to blank out user properties?" thread.<o:p></o:p></p>
<p>The technical reason why the data cannot be cleaned up by the same mapping that provides them is the fact that the inbound mapping is no longer applied when the account is gone.<o:p></o:p></p>
<p>So a workaround has to be conceived. Some of these workarounds are discussed in the mentioned thread. (What comes to my mind, though, is to map data from the resource to a set of auxiliary user properties, from where they are propagated to the "main" properties
- Titolo, Matricola, ... - under condition of hasLinkedAccount for the resource.)<o:p></o:p></p>
<p>Best regards,<o:p></o:p></p>
<pre>Pavol Mederly<o:p></o:p></pre>
<pre>Software developer<o:p></o:p></pre>
<pre>evolveum.com<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<div>
<p class="MsoNormal">On 21/10/2020 15:43, Andrea Picconi via midPoint wrote:<o:p></o:p></p>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Petr,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I mean that the field (or fields) must be blank.
</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">With the account still linked, the fields are filled (example here)</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><img width="437" height="142" style="width:4.552in;height:1.4791in" id="Immagine_x0020_1" src="cid:d163f0ab965731cd0b197fef704c470bafbea49b.camel@ndsu.edu" data-inline="" data-name="image001.jpg"></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">but if I unlink the account, I expect midpoint to deprovision and remove the attributes of that account (here the same with what I expect)</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><img width="467" height="145" style="width:4.8645in;height:1.5104in" id="Immagine_x0020_2" src="cid:95b891a38ec00d3a9e2e10d63153c0da7721a3b1.camel@ndsu.edu" data-inline="" data-name="image002.jpg"></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Thanks</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Petr Gašparík - AMI Praha a.s.
<a href="mailto:petr.gasparik@ami.cz"><petr.gasparik@ami.cz></a> <br>
<b>Sent:</b> Wednesday, October 21, 2020 3:32 PM<br>
<b>To:</b> midPoint General Discussion <a href="mailto:midpoint@lists.evolveum.com">
<midpoint@lists.evolveum.com></a><br>
<b>Cc:</b> Andrea Picconi <a href="mailto:andrea.picconi@innovery.net"><andrea.picconi@innovery.net></a>; Marianna De Biasio
<a href="mailto:marianna.debiasio@innovery.net"><marianna.debiasio@innovery.net></a>; Jacopo Giuliano
<a href="mailto:jacopo.giuliano@innovery.net"><jacopo.giuliano@innovery.net></a><br>
<b>Subject:</b> Re: [midPoint] Problem deprovisioning</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal">Please elaborate more on what means "delete attributes" :)<br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif">--</span><o:p></o:p></p>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif">s pozdravem</span><o:p></o:p></p>
<div>
<p><strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Petr Gašparík</span></strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
</span><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:gray">konzultant IT bezpečnosti</span><o:p></o:p></p>
</div>
<p><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black">gsm: [+420] 603 523 860<br>
e‑mail: <a href="mailto:petr.gasparik@ami.cz" target="_blank">petr.gasparik@ami.cz</a></span><o:p></o:p></p>
<p><strong><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black">AMI Praha a.s.</span></strong><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black"><br>
Pláničkova 11, 162 00 Praha 6</span><o:p></o:p></p>
<p><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black">tel.: [+420] 274 783 239 | web: <a href="https://www.ami.cz" target="_blank">www.ami.cz</a></span><o:p></o:p></p>
<p style="margin-top:15.0pt"><span style="font-size:7.5pt;font-family:"Verdana",sans-serif;color:black;border:solid windowtext 1.0pt;padding:0cm"><img border="0" width="100" height="100" style="width:1.0416in;height:1.0416in" id="_x0000_i1027" src="cid:3af256d003f531122030b4e1a1e6b558480f4637.camel@ndsu.edu" alt="Immagine rimossa dal
mittente. AMI Praha a.s." data-inline="" data-name="image003.jpg"></span><o:p></o:p></p>
<p><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#AAAAAA">Textem tohoto e‑mailu podepisující neslibuje uzavřít ani neuzavírá za společnost AMI Praha a.s.<br>
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně písemnou formu.<br>
</span><span style="font-size:4.5pt;font-family:"Arial",sans-serif;color:#AAAAAA"> </span><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#AAAAAA"><br>
Tento e‑mail je určen výhradně pro potřeby jeho adresáta/ů a může obsahovat důvěrné nebo osobní<br>
informace. Nejste‑li zamýšleným příjemcem, je zakázáno jakékoliv zveřejňování, zprostředkování<br>
nebo jiné použití těchto informací. Pokud jste obdrželi e‑mail neoprávněně, informujte o tom prosím<br>
odesílatele a vymažte neprodleně všechny kopie tohoto e‑mailu včetně všech jeho příloh. Nakládáním<br>
s neoprávněně získanými informacemi se vystavujete riziku právního postihu.</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">st 21. 10. 2020 v 15:24 odesílatel Andrea Picconi via midPoint <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>> napsal:<o:p></o:p></p>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div>
<div>
<p><span lang="EN-US">Hello everyone,</span><o:p></o:p></p>
<p><span lang="EN-US">I have a problem while unlinking an account from a user: what happens is that the unlink process correctly removes the account inside the Projections tab , but it doesn’t deprovision the attributes that are mapped within that account.</span><o:p></o:p></p>
<p><span lang="EN-US">What could cause this unexpected behaviour? And how do i get all these attributes to be deleted from Midpoint ?</span><o:p></o:p></p>
<p>Regards,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt">Andrea Picconi</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><i><span style="font-size:10.0pt">IAM (Identity Access Management)</span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"><img border="0" width="136" height="33" style="width:1.4166in;height:.3437in" id="gmail-m_-2628088092099569107Immagine_x0020_1" src="cid:49d79fc9f4cd9f7e7e3b1204f8878ed2b3737713.camel@ndsu.edu" alt="Innovery" data-inline="" data-name="image004.png"></span><span style="font-size:10.0pt"><br>
Skype: precons</span><br>
<span style="font-size:10.0pt">T: +39 06 51963439 (int. 196) <br>
</span><span style="font-size:12.0pt"><br>
</span><span style="font-size:10.0pt;color:black">Strada Quattro Palazzina A6 c/o Centro Direzionale Milanofiori, 20057 Assago (MI).<br>
</span><span style="font-size:10.0pt"><a href="http://www.innovery.net/" target="_blank"><span style="color:#0563C1">www.innovery.net</span></a> | T: +39 06 519 63 439</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>midPoint mailing list<o:p></o:p></pre>
<pre><a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><o:p></o:p></pre>
<pre><a href="https://lists.evolveum.com/mailman/listinfo/midpoint">https://lists.evolveum.com/mailman/listinfo/midpoint</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
</blockquote>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>midPoint mailing list<o:p></o:p></pre>
<pre><a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><o:p></o:p></pre>
<pre><a href="https://lists.evolveum.com/mailman/listinfo/midpoint">https://lists.evolveum.com/mailman/listinfo/midpoint</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
</blockquote>
</div>
</blockquote>
</body>
</html>